optional DaemonSetUpdateStrategy updateStrategy = 3;

  // The minimum number of seconds for which a newly created DaemonSet pod should
  // be ready without any of its container crashing, for it to be considered
  // available. Defaults to 0 (pod will be considered available as soon as it
  // is ready).
  // +optional
  optional int32 minReadySeconds = 4;

  // The number of old history to retain to allow rollback.

							},
						},
					},
					Status: corev1.PodStatus{
						Phase: corev1.PodRunning,
						ContainerStatuses: []corev1.ContainerStatus{
							{
								Name:  "istio-proxy",
								Ready: true,
							},
						},
					},
				},
				&corev1.Pod{
					ObjectMeta: metav1.ObjectMeta{
						Name:      "ingress",
						Namespace: "default",
						Labels: map[string]string{

    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None
    admissionReviewVersions: ["v1beta1", "v1"]
    objectSelector:
      matchExpressions:

NAME     VHOST NAME     DOMAINS     MATCH                  VIRTUAL SERVICE
         backend        *           /healthz/ready*        

	pods := s.handlers.GetAmbientPods()
	err := s.dataplane.ConstructInitialSnapshot(pods)
	if err != nil {
		log.Warnf("failed to construct initial snapshot: %v", err)
	}

	log.Info("CNI ambient server marking ready")
	s.Ready()
	s.dataplane.Start(s.ctx)
	s.handlers.Start()
}

func (s *Server) Stop() {
	log.Info("CNI ambient server terminating, cleaning up node net rules")

	s.cniServerStopFunc()
	s.dataplane.Stop()

message EndpointConditions {
  // ready indicates that this endpoint is prepared to receive traffic,
  // according to whatever system is managing the endpoint. A nil value
  // indicates an unknown state. In most cases consumers should interpret this
  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints.
  // +optional
  optional bool ready = 1;

    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None
    admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}

  optional DeploymentStrategy strategy = 4;

  // minReadySeconds is the minimum number of seconds for which a newly created pod should be ready
  // without any of its container crashing, for it to be considered available.
  // Defaults to 0 (pod will be considered available as soon as it is ready)
  // +optional
  optional int32 minReadySeconds = 5;

  // revisionHistoryLimit is the number of old ReplicaSets to retain to allow rollback.

	cniInstalls = monitoring.NewSum(
		"istio_cni_installs_total",
		"Total number of CNI plugins installed by the Istio CNI installer",
	)

	installReady = monitoring.NewGauge(
		"istio_cni_install_ready",
		"Whether the CNI plugin installation is ready or not",
	)

	DefaultRevisionName = "default"
)

const (
	// ExperimentalMsg indicate active development and not for production use warning.
	ExperimentalMsg = `THIS COMMAND IS UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.`
)

const (
	JSONFormat  = "json"
	TableFormat = "table"